Vault-Escrowed LXD Cluster Join
Nodes join the LXD cluster through a one-time-use token escrowed in Vault, with encrypted joiner secrets for bootstrap.
- Cloud-init configures the node’s network against the chosen baseline, installs LXD, and joins the cluster using a join token that is escrowed in Vault and consumed exactly once.
- Joiner secrets are node-scoped and encrypted, decrypted exactly once during deployment; reuse of a bootstrap token is treated as a security event.
- Root disks support LUKS encryption with a choice of sealing tiers — TPM2-only, TPM2+PIN, or network-bound.